Skip to content
OpenAdvisories

Vendor

Suite CRM

70 known vulnerabilities.

Products

SuiteCRM 62 SuiteCRM-Core 6 Suite CRM 2
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-100358

    SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP langu…

    Suite CRM SuiteCRM
  • Critical 9.9
    CVE-2026-71550

    SuiteCRM: LFI to RCE via AOW_WorkFlow

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved fi…

    Suite CRM SuiteCRM
  • Critical 9.1
    CVE-2026-29103

    SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary syst…

    Suite CRM SuiteCRM
  • Critical 9.3
    CVE-2022-50589

    SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality

    SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.

    Suite CRM SuiteCRM
  • Critical 9.9
    CVE-2024-1644

    Suite CRM v7.14.2 - RCE via Local File Inclusion

    Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI.

    Suite CRM Suite CRM